If you believe you have found a security vulnerability, please open a private advisory on GitHub for this repository or contact the maintainers with details and reproduction steps. Do not file public issues for undisclosed vulnerabilities.

This project is experimental research code. It is not hardened for hostile networks; treat deployments accordingly.

The verified CLI TLS and application-auth contract is documented in docs/TLS_AUTH.md and exercised by make test-tls-auth.

StreamHive can wrap peer connections in TLS:

• -tls-cert and -tls-key enable TLS on the listener.
• -tls-ca and -tls-server-name enable outbound certificate verification.
• -tls-client-cert and -tls-client-key present a client certificate on outbound dials.
• -tls-client-ca with -tls-require-client-cert enables strict inbound client verification.
• -tls-insecure-skip-verify is for local development only.

Library users can configure p2p.TCPTransport.TLSServerConfig and p2p.TCPTransport.TLSClientConfig directly. Use tls.Config.ClientAuth, ClientCAs, and client certificates when you need mTLS.

Inbound library TLS handshakes complete before peer registration and are bounded by TCPTransport.TLSHandshakeTimeout (default p2p.DefaultTLSHandshakeTimeout). Aggregate tls_handshake_success and tls_handshake_failures metrics expose the result without certificate or remote-address labels. The real-TCP library proof is make test-mtls; the CLI proof is make test-mtls-cli.

TLS protects the TCP channel and, when configured with CA verification, authenticates the certificate presented by the peer.

StreamHive also has optional shared-token peer admission:

• -peer-auth-token requires peers to send a matching token before registration.
• -peer-auth-timeout bounds how long a connection can sit in the auth handshake.
• -peer-id exchanges a bounded printable application identity for peer snapshots and logs.
• -peer-allow-ids applies an exact inbound identity allowlist after token validation.
• Library users can set p2p.TCPTransport.PeerAuthToken and PeerAuthTimeout.
• Library users can set PeerAuthIdentity and PeerAuthAllowedIdentities for the same identity boundary.

The exchanged identity is an operational label, not a cryptographic proof. The allowlist provides exact inbound authorization scoped to the shared token, but it is not a full ACL system and replication messages are not signed. Use shared-token auth with TLS/mTLS when the token or identity crosses a network boundary, and rotate the token if it appears in logs, shell history, or process metadata. Do not expose the P2P port to untrusted networks without a deployment-level trust boundary.

CI runs govulncheck ./... on each push and pull request to main.

The sbom CI job emits a CycloneDX JSON bill of materials (sbom.cdx.json) as a workflow artifact for supply-chain review.